ASD ISM 1567 Avoid high-risk suppliers in cyber supply chain
What it says
Suppliers identified as high risk by a cyber supply chain risk assessment are not used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSuppliers considered high risk are not chosen to ensure the security of the supply chain.
This control is about not choosing suppliers who might pose a risk to the cyber security of your business. Imagine if you bought a lock for your front door from someone you know makes weak locks: you'd be leaving your house exposed to break-ins. In the same way, using high-risk suppliers can leave your business open to cyber attacks, data theft, or other serious problems.
Free. Save your status, tasks and notes.
Why it matters
Using suppliers assessed as high risk can introduce supply chain compromise, leading to breaches, outages and loss of customer trust.
How to implement
Procurement officers should verify the security credentials of potential suppliers.
Start by asking the suppliers to provide their cyber security policies and any security certifications they have. This will help assess whether they align with your organisation's security needs.
Risk management teams should conduct a thorough risk assessment of all suppliers.
Use a standard checklist to evaluate their security posture, such as their history of data breaches and measures they take to protect data. Consider using third-party services for an impartial assessment.
IT managers should establish clear criteria for what constitutes a high-risk supplier.
Collaborate with cyber security experts to define these criteria based on factors like supplier access to sensitive data and their past security incidents.
Business owners and managers should hold regular meetings to review and update the supplier risk assessments.
Make sure to involve key stakeholders, including IT and procurement, to discuss any changes in supplier risk status and update strategies accordingly.
The legal team should review contracts with suppliers to ensure clauses are included that require compliance with your security standards.
This can include termination clauses if suppliers fail to meet these standards or are identified as high risk.
Keep it running
Perform and document cyber supply chain risk assessments, and exclude suppliers rated high risk; reassess regularly and on major supplier changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The supplier risk assessment report: Request a document detailing how each supplier has been evaluated for their risk level.
Look at
Whether each supplier has been assessed against established criteria.
Good evidence
Will include a comprehensive and up-to-date supplier assessment report highlighting any identified risks.
- Check 2 of 5What an auditor asks for
Ask for
Suppliers to provide copies of their security certifications like ISO/IEC 27001.
Look at
Recent and relevant certifications that are recognised in the industry.
Good evidence
Will show that the supplier possesses valid and current certifications.
- Check 3 of 5What an auditor asks for
Ask for
To see supplier contracts: Examine contracts for clauses concerning cyber security compliance and risk management.
Look at
Explicit terms that require adherence to cyber security standards.
Good evidence
Contract will include specific language addressing security expectations and contingency measures.
- Check 4 of 5What an auditor asks for
Ask for
Meeting records where supplier risks were discussed: Review minutes from meetings where supplier risk management was on the agenda.
Look at
Attendance by relevant stakeholders and documented decisions or actions taken.
Good evidence
Record will show thoughtful engagement with the topic and planned remediation actions.
- Check 5 of 5What an auditor asks for
Look at
The list of suppliers who were removed from the approved list due to unacceptable risk levels. Check if the decision was backed by documented risk assessments.
Good evidence
Indicates that steps were taken based on unreliable or non-compliant suppliers being identified and that actions were documented.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.19.
ISM-1567 requires organisations to avoid using suppliers that have been assessed as high risk in the cyber supply chain. ISO/IEC 27001:2022 Annex A 5.19 requires processes and procedures to manage information security risks arising from supplier products and services, which includes assessment, selection, and ongoing governance of suppliers. ISM-1567 maps to one specific outcome of supplier risk management (excluding high-risk suppliers), while Annex A 5.19 covers a broader range of risk treatments and relationship management activities.
This control partially meets A.5.21.
ISM-1567 requires that suppliers identified as high risk through a cyber supply chain risk assessment are not used. ISO/IEC 27001:2022 Annex A 5.21 establishes the broader requirement to define and implement processes to manage information security risks across the ICT supply chain, which would include assessing supplier risk and making sourcing decisions. ISM-1567 is a specific risk treatment decision (avoidance) within the wider supply chain risk management program required by Annex A 5.21.
This control depends on A.5.22.
ISM-1567 requires that suppliers deemed high risk by a cyber supply chain risk assessment are not used. ISO/IEC 27001:2022 Annex A 5.22 focuses on regularly monitoring, reviewing, and managing changes in supplier security practices and service delivery, which helps identify when a supplier becomes high risk. Annex A 5.22 supports ISM-1567 by providing the ongoing assurance and change-detection needed to trigger re-assessment and potential supplier avoidance, but it does not itself mandate excluding high-risk suppliers.
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.GOV-11.2.
IT.GOV-11.2 requires current assurance that suppliers still meet their cyber security commitments, with action if it lapses or their risk changes; ISM-1567 sets one firm response, not using suppliers that a cyber supply chain risk assessment identifies as high risk.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.